Currently while handling the 24 bit VNI field in VXLAN code,
netdev-offload-dpdk will actually read and write 32 bits. The byte that
is overwritten is reserved and supposed to be set to zero anyways, so
this is mostly harmless.

However, Openscanhub correctly identified this as a buffer overrun. Now
memcpy is used to limit the memory range accessed.

Reported-at: https://issues.redhat.com/browse/FDP-1122
Signed-off-by: Mike Pattrick <[email protected]>
---
v3:
 - Change from memcpy to ovs_16aligned_be32
---
 lib/netdev-offload-dpdk.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/lib/netdev-offload-dpdk.c b/lib/netdev-offload-dpdk.c
index 16f863284..82461fbd9 100644
--- a/lib/netdev-offload-dpdk.c
+++ b/lib/netdev-offload-dpdk.c
@@ -607,17 +607,16 @@ dump_flow_pattern(struct ds *s,
     } else if (item->type == RTE_FLOW_ITEM_TYPE_VXLAN) {
         const struct rte_flow_item_vxlan *vxlan_spec = item->spec;
         const struct rte_flow_item_vxlan *vxlan_mask = item->mask;
-        ovs_be32 spec_vni, mask_vni;
 
         ds_put_cstr(s, "vxlan ");
         if (vxlan_spec) {
             if (!vxlan_mask) {
                 vxlan_mask = &rte_flow_item_vxlan_mask;
             }
-            spec_vni = get_unaligned_be32(ALIGNED_CAST(ovs_be32 *,
-                                                       vxlan_spec->vni));
-            mask_vni = get_unaligned_be32(ALIGNED_CAST(ovs_be32 *,
-                                                       vxlan_mask->vni));
+            ovs_be32 spec_vni = get_16aligned_be32(
+                &ALIGNED_CAST(struct vxlanhdr *, vxlan_spec)->vx_vni);
+            ovs_be32 mask_vni = get_16aligned_be32(
+                &ALIGNED_CAST(struct vxlanhdr *, vxlan_mask)->vx_vni);
             DUMP_PATTERN_ITEM(vxlan_mask->vni, false, "vni", "%"PRIu32,
                               ntohl(spec_vni) >> 8, ntohl(mask_vni) >> 8, 0);
         }
@@ -695,8 +694,8 @@ dump_vxlan_encap(struct ds *s, const struct rte_flow_item 
*items)
     if (vxlan) {
         ovs_be32 vni;
 
-        vni = get_unaligned_be32(ALIGNED_CAST(ovs_be32 *,
-                                              vxlan->vni));
+        vni = get_16aligned_be32(&ALIGNED_CAST(struct vxlanhdr *,
+                                               vxlan)->vx_vni);
         ds_put_format(s, "vni %"PRIu32" ", ntohl(vni) >> 8);
     }
     if (udp) {
@@ -1300,9 +1299,9 @@ parse_vxlan_match(struct flow_patterns *patterns,
     vx_spec = xzalloc(sizeof *vx_spec);
     vx_mask = xzalloc(sizeof *vx_mask);
 
-    put_unaligned_be32(ALIGNED_CAST(ovs_be32 *, vx_spec->vni),
+    put_16aligned_be32(&ALIGNED_CAST(struct vxlanhdr *, vx_spec)->vx_vni,
                        htonl(ntohll(match->flow.tunnel.tun_id) << 8));
-    put_unaligned_be32(ALIGNED_CAST(ovs_be32 *, vx_mask->vni),
+    put_16aligned_be32(&ALIGNED_CAST(struct vxlanhdr *, vx_mask)->vx_vni,
                        htonl(ntohll(match->wc.masks.tunnel.tun_id) << 8));
 
     consumed_masks->tunnel.tun_id = 0;
-- 
2.51.0

_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev

Reply via email to